What we do with your details

Only what you send us. The enquiry form asks for your name, phone number, email, the date and session you want, the number of riders, your experience, and anything you type in the notes box. A gift voucher holds the buyer's name and email, and the recipient's if you give them.

Once a session is confirmed, each rider fills in a responsibility form: full name, date of birth, nationality, passport or ID number, phone, an emergency contact, for under-18s the parent or guardian's name, relationship, phone and ID number, and whether they have a health condition the instructor should know about. That health answer is kept only with the rider's explicit consent (GDPR art. 9(2)(a)), and only so the session can be run safely. The form also records when it was signed, from which browser and IP address, so a signature can be shown to be genuine.

If you arrive by scanning one of our QR codes, the server notes the time, which code it was, your browser's user agent and your IP address, so we can count real scans and leave out robots. We do not use that to identify you.

Enquiries and bookings: because you asked us about a session, and we need the details to answer you and run it safely — steps taken at your request before a contract (GDPR art. 6(1)(b)). Invoices and session records: because Portuguese accounting and insurance rules require them (art. 6(1)(c)). QR scan counts: our legitimate interest in knowing which flyers work (art. 6(1)(f)). Analytics cookies: only your consent (art. 6(1)(a)), which you can take back at any time.

Nothing is sold, rented or shared with advertisers. These companies process data for us, under data-processing terms, and only to provide their service:

• Cloudflare — hosts this website and forwards email sent to our address.
• Supabase — stores enquiries, event requests and gift vouchers, in its EU (Ireland) region.
• Resend — sends our emails to you, from its EU (Ireland) region.
• Google — Google Analytics, only if you accept analytics cookies.
• Meta (WhatsApp) — only if you choose to message us on WhatsApp.

Some of them are US companies, so data can reach the United States. Those transfers rely on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses. WhatsApp messages sit on Meta's infrastructure under their own terms; if you would rather not use it, email hello@elevafoil.com and we will only reply by email. The weather forecast on this site is fetched by our server from Open-Meteo; nothing about you is sent to them.

Enquiries that do not become bookings are deleted within twelve months. Records of sessions that did happen are kept for as long as insurance and Portuguese accounting rules require, which is ten years for invoices. QR scan records are kept for up to twelve months. Google Analytics data is kept for at most fourteen months.

We film your session and send you the file. We keep our copy for thirty days so you can ask for it again, then delete it — unless you have told us we may keep and use it, which we will only ever ask for directly.

This site sets no advertising cookies and nothing here follows you to other websites. Google Analytics only runs if you click Accept on the banner: it records which pages were opened, roughly where in the world from, and which link or QR code you arrived by — never your name, your email or anything you typed into a form. Google Signals and ad personalisation are switched off.

Changed your mind? Cookie settings lets you accept or reject again; rejecting deletes the Google Analytics cookies.

Under the GDPR you can ask for a copy of what we hold, have it corrected or deleted, restrict or object to how we use it, receive it in a portable format, and withdraw consent at any time without affecting what happened before. Email hello@elevafoil.com and we will reply within a month. If you are unhappy with how we handle it, you can complain to the CNPD, the Portuguese data protection authority.